Reflected XSS in Drupal Anti-Spam by CleanTalk

Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Anti-Spam by CleanTalk allows Reflected XSS. This issue affects Anti-Spam by CleanTalk versions: from 0.0.0 to 9.7.1.

• Affected product: the Drupal Anti-Spam by CleanTalk module.
• Structured affected range: from 0.0.0 through versions less than 9.7.1, with status affected.
• The Drupal advisory also states the affected range as <9.7.1.
• Drupal identifies Anti-Spam by CleanTalk 9.7.1 as the release to install. The status of other parallel or later branches is not established beyond these boundaries.

The flaw is in how the module handles response messages from the CleanTalk cloud API before placing them in HTML. The _cleantalk_die() and ct_die() functions output the API response message directly into HTML without sufficient sanitization, allowing arbitrary HTML or JavaScript injection. The advisory states that an attacker must be able to influence the CleanTalk cloud API response, for example through a man-in-the-middle attack or a compromised API server. When the controlled response is rendered in a browser, the data may be interpreted as markup or script in the context of the Drupal page. The specific endpoint, malicious message format, and payload sequence are not established by the available sources.

The issue can be reached over the network when Anti-Spam by CleanTalk receives and renders a response from the CleanTalk cloud API. The supplied assessment describes no pre-existing privileges, low attack complexity, and required user interaction, but control of the API response is the important practical precondition. The advisory gives a man-in-the-middle attack or a compromised API server as examples of how that condition could arise. The supplied record does not mark this CVE as known exploited; public_exploit is false, and the CISA-ADP SSVC data shown by NVD records exploitation as none. This does not establish that unobserved or unreported exploitation is impossible.

The flaw allows HTML or JavaScript from an API response to enter rendered output without sufficient sanitization, creating a Reflected XSS condition. The supplied assessment describes network reachability, no required privileges, low attack complexity, and required user interaction, with changed scope. Practical impact depends on whether the attacker can alter the CleanTalk cloud API response and whether a user visits or interacts with the affected content. Possible consequences include altered rendered content or limited access to data and actions available in the browser session, while no availability impact is established.

If the API response can be controlled, attacker-supplied HTML or JavaScript may be processed by the browser in the context of the Drupal page that renders the response. Possible consequences include loss of page-content integrity and limited access to data or functions available to a user who interacts with the affected content. The supplied assessment describes low confidentiality and integrity impact and no availability impact. The advisory does not identify a specific breach, victim, or campaign.

1. Upgrade the Drupal Anti-Spam by CleanTalk module to 9.7.1, which Drupal identifies as the fixed release.
2. Verify after deployment that the running package is actually 9.7.1 and that no affected copy remains in sites, containers, or deployment artifacts.
3. If an upgrade cannot be completed immediately, protect the integrity of the connection and systems that provide the CleanTalk API response, because the advisory identifies response manipulation as an important mitigating condition. The source does not provide a specific temporary workaround, so this measure should not be treated as a substitute for upgrading.
4. Review sites that previously ran an affected version for unusual HTML or JavaScript in content generated from CleanTalk responses.

1. Inventory Drupal sites that install the Anti-Spam by CleanTalk module and identify the deployed module version.
2. Locate installations in the affected range from 0.0.0 through versions less than 9.7.1, which is the range supported by the advisory evidence.
3. Inspect the module package or source to confirm whether _cleantalk_die() and ct_die() are present and used in the API response handling path.
4. Review proxy, TLS inspection, firewall, and outbound connection logs for anomalies involving CleanTalk responses or loss of integrity in the connection path. This is precautionary monitoring, not a confirmed indicator of compromise.
5. Review HTML output associated with CleanTalk error or response messages if unusual markup or script appears. Absence of suspicious log entries or output is not proof that the installation is safe.